NSA ANT Raumüberwachung, 30C3, Jacob Appelbaum, 30 December 2013 


Um in Räume hineinzuhorchen und zu sehen, ohne tatsächlich Funksignale aussendende Wanzen zu 
installieren, hat die NSA-Abteilung ANT eine ganze Reihe von Gerätschaften entwickelt. Die meisten basier 
auf einer Kombination von Hardware-Einbauten, die ein sehr unauffälliges Signal erzeugen und einer Radaı 
Einheit, die von außen auf den überwachten Raum gerichtet wird. Die zurückgeworfenen Radarwellen werd 
durch das Signal des im Raum versteckten Implantats verändert. Auf diese Weise lässt sich der Ort eines ir 
Raum platzierten Gegenstandes ebenso erfassen (TAWDRYYARD) wie im Raum gesprochene Sprache 
(LOUDAUTO) oder das auf einem Monitor angezeigte Bild (NIGHTWATCH, RAGEMASTER). Die Familie 
dieser Kombinations-Spähgeräte aus Hardware-Implantat und Radarerfassung nennt die Abteilung ANT 
ANGRYNEIGHBOR - zorniger Nachbar. Die Radareinheit CTX4000 dagegen kann Abstrahlungen von Geré 
wie Laserdruckern sichtbar machen, auch wenn die kein Implantat aufweisen. Dieses System nennt die NS, 
DROPMIRE - es wurde internen Dokumenten zufolge beispielsweise gegen die EU-Niederlassung in 
Washington eingesetzt. 


CTX4000 ist ein Sender kontinuierlicher Radarwellen zur Signalanalyse der Reflektionen von Implantaten el 
der ANGRYNEIGHBOR-Familie. Es wird unter anderem zum Datensammeln mit einer DROPMIRE genann! 
Methode genutzt — diese kam beispielsweise gegen die EU-Vertretung in Washington zum Einsatz. 


LOUDAUTO ist eine passive Audio-Wanze, die Sprache aufzeichnet und durch Radarwellen -Bestrahlung di 
Daten nach außen übermittelt. 


NIGHTWATCH ist ein System zur Rekonstruktion von Monitorsignalen angegriffener Zielsysteme. 


PHOTOANGLO ist ein weiterentwickeltes Radarsystem (Nachfolger des CTX4000), das die Reflexionen 
kontinuierlicher Signale auswertet. Damit lassen sich passive Wanzen wie die der ANGRYNEIGHBOR-Fam 
von Weitem auslesen. 


TAWDRYYARD ist ein Hardware-Modul, das eingehende Radarwellen zurückwirft und es so möglich machi 
es etwa durch Wände in einem Raum zu lokalisieren. Es wird unter anderem benutzt, um RAGEMASTER- 
Module, die Monitore überwachen sollen (siehe unter "Bildschirm"), leichter auffindbar zu machen. 


TOP SECRET//COMINT//REL TO USA, FVEY 


CTX4000 


ANT Product Data 


(TS//SI//REL TO USA,FVEY) The CTX4000 is a portable continuous wave (CW) 
radar unit. It can be used to illuminate a target system to recover different off net | 8 Jul 2008 
information. Primary uses include VAGRANT and DROPMIRE collection. 


that otherwise would not be collectable, or would be extremely difficult to collect 
and process. It provides the following features: N ĝ 0 N) f 
¢ Frequency Range: 1 - 2 GHz. 
* Bandwidth: Up to 45 MHz 
« Output Power: User adjustable up to 2 W using the internal amplifier; external 
amplifiers make it possible to go up to 1 kW. 
« Phase adjustment with front panel knob 
+ User-selectable high- and low-pass filters. 
« Remote controllable 
¢ Outputs: 
* Transmit antenna 
« | & Q video outputs 
« DC bias for an external pre-amp on the Receive input connector 
« Inputs: 
« External oscillator 
* Receive antenna 


Unit Cost: N/A 


Status: unit is operational. However, it is reaching the end of its service life. It is 
scheduled to be replaced by PHOTOANGLO starting in September 2008. 
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LOUDAUTO 
ANT Product Data 


(TS//SI//REL TO USA,FVEY) Audio-based RF retro-reflector. Provides room 07 Apr 2009 
audio from targeted space using radar and basic post-processing. 


(U) Capabilities 

(TS//SI//REL TO USA,FVEY) LOUDAUTO's 
current design maximizes the gain of the 
microphone. This makes it extremely useful for 
picking up room audio. It can pick up speech at 

a standard, office volume from over 20' away. 
(NOTE: Concealments may reduce this distance.) 
It uses very little power (~15 uA at 3.0 VDC), so u «ly 
little, in fact, that battery self-discharge is more of 
an issue for serviceable lifetime than the power 
draw from this unit. The simplicity of the design 
allows the form factor to be tailored for specific 
operational requirements. All components at 
COTS and so are non-attributable to NSA. 00006 


(U) Concept of Operation 

TS/ISWIREL TO USA,FVEY) Room audio is picked up by the microphone and 
converted into an analog electrical signal. This signal is used to pulse position 
modulate (PPM) a square wave signal running at a pre-set frequency. This 
square wave is used to turn a FET (field effect transistor) on and off. When 
the unit is illuminated with a CW signal from a nearby radar unit, the 
illuminating signal is amplitude-modulated with the PPM square wave. This 
signal is re-radiated, where it is picked up by the radar, then processed to 
recover the room audio. Processing is currently performed by COTS 
equipment with FM demodulation capability (Rohde & Schwarz FSH-series 
portable spectrum analyzers, etc.) LOUDAUTO is part of the 
ANGRYNEIGHBOR family of radar retro-reflectors. 


Unit Cost: $30 


Status: End processing still in development 
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Derived From: NSA/CSSM 1-52 
Dated: 20070108 
Declassify On: 20320108 
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NIGHTWATCH 
ANT Product Data 


(TS//SI//REL TO USA,FVEY) NIGHTWATCH is a portable computer with 
specialized, internal hardware designed to process progressive-scan (non- 24 Jul 2008 
interlaced) VAGRANT signals. 


(U) Capability Summary 

(TS//SI//REL TO USA,FVEY) The current 
implementation of NIGHTWATCH consists of 
a general-purpose PC inside of a shielded 
case. The PC has PCI digitizing and clock 
cards to provide the needed interface and 
accurate clocking required for video 
reconstruction. It also has: 

* horizontal sync, vertical sync and video 
outputs to drive an external, multi-sync 
monitor. 


* video input N a 6 

* spectral analysis up to 150 kHz to provide for indications of horizontal and 

vertical sync frequencies 

+ frame capture and forwarding L 0 d 0 
* PCMCIA cards for program and data storage i N) i 

* horizontal sync locking to keep the display set on the NIGHTWATCH display. 

* frame averaging up to 216 (65536) frames. TIT) 


(U) Concept of Operation 

(TS//SI//REL TO USA,FVEY) The video output from an appropriate collection Qj 1 
system, such as a CTX4000, PHOTOANGLO, or general-purpose receiver, is 

connected to the video input on the NIGHTWATCH system. The user, using the AA 
appropriate tools either within NIGHTWATCH or externally, determines the 

horizontal and vertical sync frequencies of the targeted monitor. Once the user 

matches the proper frequencies, he activates "Sync Lock" and frame averaging 

to reduce noise and improve readability of the targeted monitor. If warranted, the 

user then forwards the displayed frames over a network to NSAW, where 

analysts can look at them for intelligence purposes. 


Unit Cost: NIA 


Status: This system has reached the end of its service life. All work concerning 
the NIGHTWATCH system is strictly for maintenance purposes. This system is 
slated to be replaced by the VIEWPLATE system. 
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PHOTOANGLO 


ANT Product Data 


(TSIISWIREL TO USA,FVEY) PHOTOANGLO is a joint NSA/GCHQ project to 
develop a new radar system to take the place of the CTX4000. 24 Jul 2008 


(U) Capabilities 
(TS//SI//REL TO USA,FVEY) The planned capabilities for this system are: 

«Frequency range: 1 - 2 GHz, which will be later extended to 1 - 4 GHz. 

«Maximum bandwidth: 450 MHz. 

«Size: Small enough to fit into a slim briefcase. 

«Weight: Less than 10 Ibs. 

«Maximum Output Power: 2 W 

«Output: 

“Video 

Transmit antenna 0 N fh 
«Inputs: 


«External oscillator N ĝ ( i) 


Receive antenna 


(U) Concept of Operation l Q ĝ ( ¢ 
(TS//SI//REL TO USA,FVEY) TS//SI//REL TO USA,FVEY) The radar unit 
generates an un-modulated, continuous wave (CW) signal. The oscillator is à ( Q 0 


either generated internally, or externally through a signal generator or cavity 
oscillator. The unit amplifies the signal and sends it out to an RF connector, i) Bl) 
where it is directed to some form of transmission antenna (horn, parabolic dish, 

LPA, spiral). The signal illuminates the target system and is re-radiated. The 6 08 
receive antenna picks up the re-radiated signal and directs the signal to the 

receive input. The signal is amplified, filtered, and mixed with the transmit 04 
antenna. The result is a homodyne receiver in which the RF signal is mixed 

directly to baseband. The baseband video signal is ported to an external BNC 

connector. This connects to a processing system, such as NIGHTWATCH, an 

LFS-2, or VIEWPLATE, to process the signal and provide the intelligence. 


Unit Cost: $40k (planned) 
Status: Development. Planned IOC is 1st QTR FYO9. 


POC: er IE BIO ns ic-c0. 


Derived From: NSA/CSSM 1-52 
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TAWDRYYARD 
ANT Product Data 


(TS//SI//REL TO USA,FVEY) Beacon RF retro-reflector. Provides return 07 Apr 2009 
when illuminated with radar to provide rough positional location. 


(U) Capabilities 
(TS//SI//REL TO USA,FVEY) TAWDRYYARD is 32NDS 


used as a beacon, typically to assist in locating 
and identifying deployed RAGEMASTER units. 
Current design allows it to be detected and located 
quite easily within a 50' radius of the radar system 
being used to illuminate it. TAWDRYYARD draws 
as 8 pA at 2.5V (20uW) allowing a standard lithium 
coin cell to power it for months or years. The 
simplicity of the design allows the form factor to 
be tailored for specific operational requirements. 
Future capabilities being considered are return of 
GPS coordinates and a unique target identifier and 


4 8 12 % 99 


automatic processing to scan a target area for @ ô i é ( 
presence of TAWDRYYARDs. All components are 

COTS and so are non-attributable to NSA. @ 0 
(U) Concept of Operation 


(TS//SI//REL TO USA,FVEY) The board generates a square wave operating 6 q N) 
at a preset frequency. This square wave is used to turn a FET (field effect 


transistor) on and off. When the unit is illuminated with a CW signal, the T1) 
illuminating signal is amplitude-modulated (AM) with the square wave. This 
signal is re-radiated, where it is picked up by the radar, then processed to 04 


recover the clock signal. Typically, the fundamental is used to indicate the 
unit's presence, and is simply displayed on a low frequency spectrum 
analyzer. TAWDRYYARD is part of the ANGRYNEIGHBOR family of radar 
retro-reflectors. 


Unit Cost: $30 
Status: End processing still in development 
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